LinuxFr.org Security oriented feedback on high traffic web site Bruno Michel – nono@linuxfr.org Benoît Sibaud – oumph@linuxfr.org Webmasters 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
LinuxFr.org French speaking news website about free software 11 years old website, with benevolent team high traffic web site (14M visits/year, 37000 accounts, 4000 active accounts, pagerank 7) news reused by other medias stores personal data (email, lastname/forname, sessions IP, passwords, etc.) many users have IT skills 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
LinuxFr.org 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
LinuxFr.org (see LSM 2008 “10 years of LinuxFr.org” for details...) 1998: first LinuxFr.org (LAMP) 2000-2002: daCode CMS (PHP3/4, GPL) used (was used by x.org) 2002-now: templeet framework (PHP4/5, GPL) + our templates in templeet+javascript 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
This talk About: ● LinuxFr.org from a security point of view ● gives a lot of experience in the security area ● security problems disclosure ● no security by obscurity Not about: ● non security related software/hardware failures ● legal aspects (libel, hate speech, etc.) ● lamers filtering (captcha, karma system, multiple accounts detection, etc.) or content (pre/post)moderation 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Security info leak: not so secret session with 2 cookies md5 and unique_id unique_id 32 randomized alphanum char md5 md5sum(concat(SECRET, unique_id)) = session id Compare user md5 cookie & server md5sum Each user: several sessions, can close each session md5 used to protect from random generator prediction 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Security info leak: not so secret Failure: SECRET was a MD5.txt file, in the DOCUMENT_ROOT Effect: useless md5 cookie Exploit: indexed by webcrawlers, available with something like 'site:linuxfr.org MD5.txt' Fix: generate a new MD5.txt, outside DOCUMENT_ROOT, purge sessions 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Social Engineering 2 ingredients A rumor than closing accounts doesn't work Curious users Alternative version: A 'click here' link (or more evil, 'do not click here') (closing account is not purging account, but you need an admin to get your account back) 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Social Engineering Effect: several users closed their accounts Exploit: a simple comment with a link Fix: Inform users Added a confirmation on that page 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Social engineering/XSS: board worm A chat via web (the LinuxFr.org board ) Free space, where many links are posted (and clicked) Sort of playground http://badguy.invalid/davirusboard/ [ 16:25:22 ] user4 – What a great link [url] [ 16:25:13 ] user3 – Huh, what the f*ck? [ 16:25:03 ] user3 – What a great link [url] [ 16:24:17 ] user2 – What a great link [url] [ 16:23:48 ] user1 – What a great link [url] 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Social engineering/XSS: board worm Failure: automatic form submit on load + no confirmation on user action + user cookies Effect: unwanted post on the daCode board Exploit: <html> <head><title>DaVirusBoard</title></head> <body onload="document.form.submit()" > <form name="form" method="post" action="http://linuxfr.org/board/add.php3" > <input type="hidden" name="message" value="What a great link. http://badguy.invalid/davirusboard/" > </form> </body> </html> 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Social engineering/XSS: board worm Fix (10/2002): check REFERER only HTTP POST ask confirmation for sensitive actions (news moderation, admin functions, account deletions...) full code check (unique token for each form... not implemented) 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
XSS on daCode news.php3 User input in news submission was filtered to a subset of HTML tags. But is this enough? 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
XSS on daCode news.php3 Failure: users can inject javascript in the src or data attribute (<img>, <object>, ...) Effect: XSS can be used to steal sessions and to gain privileges Fix (09/2002): + $table['body'] = preg_replace('/(src|data)([\s])?=(["\'\s])?javascript:/i','', $table['body']); 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
XSS again on the cuthtml function The cuthtml function in templeet is used for cutting HTML texts... but also for cleaning it: ● makes HTML well-formed ● deletes not-allowed tags (like <iframe>) ● deletes not-allowed attributes But is this enough? 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
XSS again on the cuthtml function Failure: users can inject javascript in the href attribute of an <a> tag. Effect: XSS can be used to steal sessions and to gain privileges Fix (10/2005): - if (preg_match("/^[\"']?\s*javascript:/i",$value)) + $decodevalue = preg_replace('~&#x([0-9a-f]+);~ei', 'chr(hexdec("\\1"))', $value); + $decodevalue = preg_replace('~&#([0-9]+);~e', 'chr(\\1)', $decodevalue); + + if (preg_match("/^[\"']?\s*(?:javascript|vbscript|mocha|livescript):/i", $decodevalue)) 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
XSS via USER_AGENT A chat via web (the board) [ 16:25:22 ] user4 – Huh? 16:23:48 [ 16:25:13 ] user3 – Oops my keyboard is blo [ 16:25:03 ] user3 – I've nothing to tell [ 16:24:17 ] user2 – LinuxFr.org is a great site [ 16:23:48 ] user1 – blabla [ 16:23:48 ] Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.8.1.20) Gecko/2008 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
XSS via USER_AGENT Failure: users can inject HTML (and javascript) via USER_AGENT Effect: XSS can be used to steal sessions and to gain privileges Fix: use htmlentities() to escape HTML for all user inputs (and addslashes() for SQL parts) 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Personal data leak: CSRF Generated js/admin.js adds the user email in a <div> via document.write() Called in each page header Generated js/users_admininfo.js do the same thing with all user personal data Called in the user page 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Personal data leak: CSRF Failure: Javascript Cross-Site Request Forgeries Direct access to some .js files and DOM reading to get info Effect: personal data leak 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Personal data leak: CSRF Exploit: <div style="display:none;" > <div id="logindelete" ></div> <script src="https://linuxfr.org/js/admin.js" ></script> <script> display_authbox(); var matches = document.getElementById('login'). innerHTML.match(/>[^@<>]*@[^<>]*</); var email = matches[0].slice(1, -1); </script> </div> <p> Email: <script> document.write(email); </script></p> Fix (2008/07): email removed from admin.js and /js/users_admininfo.js => /js/users_admininfo,T3VtcGg=.js (salt) 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Session hijacking: random generator The site was using daCode 1.4 CMS (and our webmasters were the daCode developpers) makerand() was used to generate session id, calling srand() with an int argument. 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Session hijacking: random generator Failure: things went in PHP4. But in PHP3, if seed ≥ 2 31 , signedness problem, (half a day) the seed and the generated id were constant. Effect: half a day, you could easily guess one session. And due to session id uniqueness, only the first one could connect. Exploit: just forge a cookie half a day Fix (2002/10): stop using bogus PHP3 (!), handle signedness for srand() 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Session hijacking: random generator (again) Two sites using daCode CMS. A user mistakenly copy its session cookie from the wrong site... and gets a valid session! (info coming from one of our users, thanks kadreg) How unlikely: sessionID = 20 alphanum char, about (26+26+10) 20 occurrences, ~7x10 35 2009/07/09 LSM 2009 LinuxFr.org: security oriented feedback on high traffic web site
Recommend
More recommend
